CmdID

CmdID / Commands

chkconfig

Manage the runlevel of services on CentOS 6. tldr-pages

On Linux 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Linux

from tldr-pages, CC BY 4.0

List services with runlevel

chkconfig --listIdentify

Show a service's runlevel

chkconfig --list ntpdIdentify

Enable service at boot

chkconfig sshd onIdentify

Enable service at boot for runlevels 2, 3, 4, and 5

chkconfig --level 2345 sshd onIdentify

Disable service at boot

chkconfig ntpd offIdentify

Disable service at boot for runlevel 3

chkconfig --level 3 ntpd offIdentify

What detects it

Sigma process creation rules that name chkconfig
mediumDisable Or Stop ServicesNasreddine Bencherchali (Nextron Systems)
mediumDisabling Security ToolsÖmer Günal, Alejandro Ortuno, oscd.community